🤖 machine learning

Black-box, Adaptive, Efficient, Transferable, Harmful, Applicable... Attacks Are All You Need to Break LLMs

This paper introduces Indirect Harm Optimization (IHO), a black-box, adaptive, and efficient jailbreak attack method that serves as a standardized evaluation baseline for assessing the adversarial robustness of Large Language Models against various defenses.

Original authors: Vincent Limbach, Jonas Dornbusch, David Lüdke, Stephan Günnemann, Leo Schwinn

Published 2026-06-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Vincent Limbach, Jonas Dornbusch, David Lüdke, Stephan Günnemann, Leo Schwinn

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard for a very smart, but sometimes too trusting, librarian (the Large Language Model, or LLM). Your job is to stop people from asking the librarian to do dangerous or illegal things, like writing phishing emails or explaining how to build a bomb.

For a long time, testing if the librarian was safe was like playing a game of "hide and seek" where the hiders (the attackers) kept changing their tactics, but the seekers (the defenders) didn’t have a standard way to check if the hiders were actually good at hiding. Sometimes, a weak hider would look strong because the seeker wasn’t looking hard enough.

This paper introduces a new, highly efficient way to test the librarian’s safety, called IHO (Indirect Harm Optimization). Here is how it works, explained with everyday analogies:

1. The Problem: The "Bad Student" vs. The "Smart Tutor"

Previously, to test if the librarian could be tricked, researchers would try to craft a specific, tricky question (a "jailbreak prompt") for every single dangerous request. It was like trying to teach a student to lie by writing a new lie for every single subject. It was slow, expensive, and if the librarian changed their rules, you had to start over.

2. The Solution: Training a "Master Trickster" Bot

Instead of writing individual tricky questions, the authors trained a separate AI bot to be a Master Trickster.

The Analogy: Think of the Master Trickster as a professional actor who specializes in bypassing security checkpoints. Instead of memorizing one specific trick, this actor learns the general art of deception.
How it’s built: They used a special type of AI called a "Diffusion Language Model." Imagine this model is like a paint-by-numbers kit where some numbers are already filled in (the dangerous request, like "write a scam email"), and the AI has to fill in the blank spaces with words that will trick the librarian into saying "yes."

3. The Training Method: "Indirect Harm Optimization" (IHO)

How does the Master Trickster learn? It doesn’t peek inside the librarian’s brain (which is usually locked away in closed-source models). Instead, it uses a Judge.

The Process:
1. The Trickster tries a bunch of different ways to phrase the request.
2. The Librarian responds.
3. A Judge AI (a separate, strict evaluator) scores the Librarian’s response. Did the Librarian actually give dangerous advice, or did it just say "I can't do that"?
4. The Trickster learns from the Judge’s score. If the Judge says, "That was a really dangerous response," the Trickster notes, "That phrasing worked!" If the Judge says, "That was safe," the Trickster notes, "That phrasing failed."
5. This happens in cycles. The Trickster gets better and better at finding the exact words that make the Librarian slip up.

This is called "Indirect" because the Trickster isn’t directly optimizing for the Librarian’s internal math; it’s optimizing for the outcome judged by the external Judge.

4. Why This Is Better: The Six Superpowers

The authors claim their method, IHO, is special because it has six key strengths that older methods lacked:

Black-Box Friendly: It doesn’t need to see the Librarian’s internal code or weights. It just talks to the Librarian like a normal user. This makes it useful for testing real-world, closed-source models (like ChatGPT or Claude) where you can’t see the inside.
Efficient: It’s fast and cheap. Once the Trickster is trained, it can be used over and over again. It’s like hiring a professional security tester once, rather than paying for a new test every single time.
Transferable: The Trickster learned on one set of dangerous requests (e.g., scams) but can also trick the Librarian on new dangerous requests it hasn’t seen before (e.g., hate speech). It learned the pattern of deception, not just specific lines.
Adaptive: It works even if the Librarian has extra security layers, like a metal detector at the door (an external safety filter). The Trickster adapts its style to get past these layers.
Harmful (in a testing sense): It doesn’t just try to get the Librarian to say "yes"; it tries to get the Librarian to say something actually dangerous. Older methods might just get a "yes" but with a harmless answer. IHO ensures the answer is genuinely risky, which is what we want to find during safety tests.
Applicable: It requires very little manual work. You don’t need to hand-craft prompts or set up complex pipelines. It’s automated.

5. A New Scorecard: EVUS

The authors also complain that the old way of measuring success—Attack Success Rate (ASR)—is flawed. ASR is like saying, "Did the thief get in? Yes/No." It doesn’t tell you how easily they got in, or how much damage they did.

They introduce a new metric called EVUS (Expected Volume Under the Surface).

The Analogy: Instead of just asking "Did the thief get in?", EVUS asks: "How many attempts did it take? How bad was the damage? And how consistent was the success?" It gives a more complete picture of the Librarian’s vulnerability, accounting for both the severity of the harm and the efficiency of the attack.

In Summary

This paper presents IHO, a new, automated, and efficient way to test if AI models can be tricked into doing harmful things. It trains a "Master Trickster" AI using feedback from a "Judge" AI, without needing to peek inside the target model. This method is faster, cheaper, and more reliable than previous techniques, providing a standardized way to measure AI safety, much like how standardized tests are used in education. The goal is to help developers find and fix weaknesses before malicious actors exploit them.

Technical Summary: Indirect Harm Optimization (IHO)

Problem Statement
The paper addresses the longstanding challenge of accurately evaluating the adversarial robustness of Large Language Models (LLMs). Reliable evaluation requires standardized attacks that can uncover genuine failures without inflating robustness estimates. While standardized attacks like AutoAttack have resolved this for image classifiers, no equivalent exists for LLM jailbreaks. Existing automated jailbreak attacks fail to jointly satisfy six critical desiderata:

Efficiency (E): Low compute and API cost.
Adversary Knowledge & Access (K): Compatibility with black-box, closed-source models.
Harmfulness (H): Ability to elicit genuinely harmful responses rather than merely bypassing refusal thresholds.
Applicability (A): Minimal manual engineering or human effort.
Transferability (T): Effectiveness across unseen behaviors and target models.
Adaptiveness (AD): Ability to adjust to specific target defenses and complex, non-differentiable pipelines.

Current methods typically cover only subsets of these properties. Gradient-based attacks (e.g., GCG) require white-box access and lack transferability. Sampling-based or LLM-as-attacker methods (e.g., PAIR, Best-of-N) are often inefficient, lack direct optimization for harmfulness, or require significant manual prompt engineering.

Methodology
The authors introduce Indirect Harm Optimization (IHO), a fully automated framework that trains a parameterized attacker model rather than optimizing individual prompts. The methodology relies on three principled design choices:

Attacker Architecture: IHO utilizes a masked diffusion language model (specifically LLaDA-8B-Base) as the attacker. Unlike autoregressive models that require hand-written prompts to specify attack strategies, the diffusion model conditions directly on the target behavior via bidirectional infilling. This eliminates prompt-specific bias and manual overhead while allowing precise control over generation length.
Optimization Objective: The goal is to maximize the expected harmfulness of the target model’s response. Since direct optimization of harm is intractable in a black-box setting, IHO uses a preference-based proxy. It employs a judge model (StrongReject) to score responses. Prompts eliciting high-harm scores are treated as "chosen" ( $p^+$ ), and those eliciting low scores as "rejected" ( $p^-$ ).
Training Procedure: The attacker is optimized using Direct Preference Optimization (DPO). This approach decouples optimization from the target model, requiring only black-box access to the target’s outputs. The process is iterative:
- The attacker generates prompts for a set of behaviors.
- The target model generates responses, which are scored by the judge.
- Preference pairs are constructed and used to update the attacker via DPO.
- This cycle repeats, with each iteration resampling preferences from the improved attacker, allowing the policy to progressively cover harder-to-break behaviors.

The attacker is implemented as a LoRA adapter on top of the frozen base diffusion model, ensuring efficient fine-tuning.

Key Contributions

Unified Attack Framework: IHO serves as both an adaptive attack (targeting specific queries against specific models, including complex pipelines with detectors) and a universal policy (transferring across behaviors and models without fine-tuning).
Reliable Metric (EVUS): The paper identifies flaws in Attack Success Rate (ASR), such as threshold dependence, severity blindness, and sensitivity to judge error. It introduces Expected Volume Under the Surface (EVUS), a metric that integrates expected attack success across thresholds and sample counts, accounting for sample efficiency and harm severity.
Extensive Ablations: The paper provides detailed ablations on design choices, including attack size, denoising steps, sample quality vs. quantity, and hyperparameters.

Results
IHO is evaluated against state-of-the-art baselines (GCG+, AmpleGCG+, PAIR, PAIR+, BON, JR1+, Inpainting) on LLaMA-3-8B and Qwen-2.5 models (7B–32B), including variants with defenses like Circuit Breakers (CB), Latent Adversarial Training (LAT), and Continuous Adversarial Training (CAT), as well as layered pipelines with external detectors (PolyGuard).

Adaptive Attacks: On training behaviors, IHO consistently outperforms baselines. Against defended models, the gap widens significantly. For example, on the Circuit Breaker model, IHO achieves an EVUS of 0.82, while the next-best baseline scores 0.63. With an added detector (CB+D), IHO retains an EVUS of 0.77, whereas baselines drop below 0.55.
Cross-Behavior Transfer: IHO demonstrates strong transferability to held-out behaviors not seen during training, achieving performance comparable to or exceeding training-set results (e.g., 0.82 EVUS on CB for held-out behaviors).
Cross-Model Transfer: IHO policies trained on one model transfer effectively to unseen target models. Transfer is strongest when source and target models have similar robustness levels.
Efficiency: IHO reduces per-sample inference FLOPs by ~76% compared to the untrained Inpainting baseline by reducing sequence length and unmasking steps. It reaches near-ceiling performance within 100 samples, significantly outperforming baselines in sample efficiency.
Harmfulness Optimization: Analysis of judge score distributions shows that IHO effectively shifts the attacker’s output distribution toward high-harm responses over training cycles, unlike methods that saturate early or optimize proxy objectives.

Significance
The paper positions IHO as a practical step toward standardized jailbreak evaluation for LLMs, analogous to AutoAttack for image classifiers. By satisfying all six desiderata—black-box compatibility, applicability to arbitrary defense pipelines, efficiency, adaptiveness, transferability, and direct optimization for harmfulness—IHO provides a more reliable baseline for assessing model robustness and comparing defenses. The authors emphasize that this standardization is crucial for accurate risk assessment and the development of effective safety measures.